If I'm logged in as $USER, and I run top and I can see a process I own can I rename that process?
If so, how? If not, can root rename a foreign process? If so, how? If not, why?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
It depends what you mean by “rename”. Processes don't have names as such. Processes have a command line. The command line need not be preserved after the program starts. All Unix variants do keep a copy of the command line, but it may be truncated or otherwise modified (e.g. running arguments together with spaces in between, so that
foo 'hello world' is not distinguishable from
foo hello world).
Most Unix variants allow a process to modify the command line that
ps shows, by modifying the content of the
argv parameter of the
main function. You can only overwrite the buffer in place, so it may not be possible to make the buffer longer, but it can always be made shorter (each argument ends at the first null byte).
From the outside of the process, you can run a debugger and edit the program's
argv. Here's a demonstration under Linux with GDB.
$ sleep 999999.00000000000000000000000000000000000000000000000 &  2131 $ ps 2131 PID TTY STAT TIME COMMAND 2131 pts/8 S 0:00 sleep 999999.0000000000000000000000000000000000000000 $ gdb -pid 2131 … (gdb) bt #0 0x00007fa1206286e0 in __nanosleep_nocancel () at ../sysdeps/unix/syscall-template.S:81 #1 0x0000000000403f3f in ?? () #2 0x0000000000403d58 in ?? () #3 0x00000000004016c9 in ?? () #4 0x00007fa120592b45 in __libc_start_main (main=0x401540, argc=2, argv=0x7fffc8b1bf18, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffc8b1bf08) at libc-start.c:287 #5 0x00000000004017d5 in ?? () (gdb) frame 4 #4 0x00007fa120592b45 in __libc_start_main (main=0x401540, argc=2, argv=0x7fffc8b1bf18, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffc8b1bf08) at libc-start.c:287 (gdb) p argv $1 = (char **) 0x7fffc8b1bf18 (gdb) p argv $2 = 0x7fffc8b1d27e "sleep" (gdb) p argv $3 = 0x7fffc8b1d284 "999999.", '0' <repeats 47 times> (gdb) argv = 'z' Undefined command: "argv". Try "help". (gdb) p argv $4 = 0x7fffc8b1d284 "999999.00z", '0' <repeats 44 times> (gdb) detach Detaching from program: /bin/sleep, process 2131 (gdb) quit $ ps 2131 PID TTY STAT TIME COMMAND 2131 pts/8 t 0:00 sleep 999999.00z0000000000000000000000000000000000000
Depending on how your system is configured, you may or may not be able to run a debugger on a program that wasn't started by the debugger, and you will not be able to run a debugger on a program that isn't running as your user with no extra privileges (except by running the debugger as root). This is controlled by the permission to use the
ptrace system call.